site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com On Apr 4, 2006, at 12:39 PM, devmaillists wrote: Hello dear mailing list, I like to modify a Ethernet packet with a interface filter extension. The subject of change is the ip destination and port number. Afraid not. -josh _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... This email sent to site_archiver@lists.apple.com I am not very familiar with the mbuf structures but I am currently learning. So here come my questions. Do I have to extract the data of an mbuf int a separate buffer to work on? Or is looping through the mbuf until I find the right position the best way. You can walk through the mbuf chain. You might run in to trouble if the data you are interested in is spread across two mbufs. There is an mbuf_pullup function to make the data contiguous, but it mail fail under certain conditions and cause the mbuf chain to be released. If I modifiy a byte in the IP data, the CS of the IP Packet and of the Ethernet packet do have to be recalculated or only the IP CS? This is tricky because the checksum is sometimes computed in hardware and sometimes it is done in software. For the hardware, the stack calculates a small portion of the checksum based on the source and destination ip address and protocol I think. My memory of these bits is vague, so some of the details might be off. Anyhow, this pre- computed value is stuff in to a part of the mbuf for hardware that requires it. To avoid all the possible different problems you could run in to, you should call mbuf_outbound_finalize first. This will force the checksum to be calculated. Then modify the header as you see fit and update the checksums as appropriate. Is there a call doing the recalculation or is it best to recalc it by my own? You will have to calculate the new checksum on your own. There is no KPI for doing this. There is a bug requesting a KPI to force the calculation of the checksum. Does anybody have s short sample? smime.p7s